torizon_audit 0.0.6 → 0.0.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 20defd644f2091e3612517bd6bc8f8546d450910e104c246c2b785093c0cad93
-  data.tar.gz: a3eb07db7d1d10cead1928d33d81ddd698d15ee5dbe7b1c3899888cc4964b916
+  metadata.gz: 2c50971c4656b798f91fc6c5425f9980f87e787dfee2c298c96621935b505923
+  data.tar.gz: dffd561304c72e55c5d0d77abc578fc27aeed8c387de97579c6dd186fd719032
 SHA512:
-  metadata.gz: 7a0bde0ecf0c0f3a7c12b5d61b563d4dd9be0034dc0fd96b34a6a7faa3a9505d810c6e347539337cefbea08d403793201b850ef3f20a44afb52e52527fa94eb7
-  data.tar.gz: 9cd5a8cc814307ad35546ff9b3d7abda0236334b679ab749d51c8f5044536f54425f06dfb449704ffe37876bbb75e973f262bc845b86022cd036363ceae98c00
+  metadata.gz: e7081b8c8313196678c72f38c70963a4e8cce844ed0ec35c89b94714206556e927319cab3ca36f5007e6178c252c2aa1383dd6bc247f082b047969222d466f3c
+  data.tar.gz: 26cb791aef470cae8b5def32a70f25d5a235989fef4b721105b687c97c52ccfc2ccc619cc3980cd9a8f70cde5b6b593599bce39ce5652219954dc69a81403566

data/lib/torizon_audit.rb

@@ -24,7 +24,7 @@ class Query
 
   def initialize(maxNumLogs = 10000)
     @query = {
-      "from" => 0, 
+      "from" => 0,
       "size" => maxNumLogs,
       "query" => {
         "bool" => {
@@ -106,14 +106,15 @@ class Audit
   end
 
   def findAction(method, uri)
-    @@actionsMap.each {|uriPattern, methodActions|
-      if uri.match(uriPattern)
-        if methodActions.key?(method)
-          return methodActions[method]
-        end
-      end
-    }
-    return "Unknown Action"
+    _, m = @@actionsMap.find do |uriPattern, methodActions|
+      uri.match(uriPattern) && methodActions.key?(method)
+    end
+
+    if m.nil?
+      "Unknown Action"
+    else
+      m[method]
+    end
   end
 
   def userActions(from, to, namespace, dropUnknownActions = true)
@@ -127,20 +128,24 @@ class Audit
     actions =  response["hits"]["hits"].map{ |obj|
       src = obj["_source"]
       {
-        "method" => src.key?("request_method") ? src["request_method"] : "",
-        "path" => src.key?("uri") ? src["uri"]: "",
-        "at" => src.key?("@timestamp") ? src["@timestamp"]: "",
-        "namespace" => src.key?("namespace") ? src["namespace"]: "",
-        "origin_namespace" => src.key?("origin_namespace") ? src["origin_namespace"]: "",
-        "status_code" => src.key?("status") ? src["status"]: "",
-        "ip" => src.key?("client_addr") ? src["client_addr"]: "",
-        "query" => src.key?("query_string") ? src["query_string"]: "",
-        "log_id" => obj.key?("_id") ? obj["_id"]: "",
-        "action" => self.findAction(src.key?("request_method") ? src["request_method"] : "", src.key?("uri") ? src["uri"]: "")
+        "time" => DateTime.parse(src.key?("@timestamp") ? src["@timestamp"]: ""),
+        "host" => "app.torizon.io",
+        "source" => "torizon",
+        "event" => {
+          "path" => src.key?("uri") ? src["uri"]: "",
+          "method" => src.key?("request_method") ? src["request_method"] : "",
+          "namespace" => src.key?("namespace") ? src["namespace"]: "",
+          "origin_namespace" => src.key?("origin_namespace") ? src["origin_namespace"]: "",
+          "status_code" => src.key?("status") ? src["status"]: "",
+          "ip" => src.key?("client_addr") ? src["client_addr"]: "",
+          "query" => src.key?("query_string") ? src["query_string"]: "",
+          "log_id" => obj.key?("_id") ? obj["_id"]: "",
+          "action" => self.findAction(src.key?("request_method") ? src["request_method"] : "", src.key?("uri") ? src["uri"]: "")
+        }
       }
     }
     if dropUnknownActions
-      return actions.select{|req| req["action"]  != "Unknown Action"} 
+      return actions.select{|req| req["event"]["action"]  != "Unknown Action"} 
     end
     return actions
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: torizon_audit
 version: !ruby/object:Gem::Version
-  version: 0.0.6
+  version: 0.0.8
 platform: ruby
 authors:
 - Ben Clouser
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-03-23 00:00:00.000000000 Z
+date: 2023-03-31 00:00:00.000000000 Z
 dependencies: []
 description: Fetch user actions from torizon platform
 email: ben.clouser@toradex.com